Blog

The OWASP AI Top 10 just got a genuine shake-up, not a reshuffle. OWASP built the 2026 edition partly on real incident data for the first time, not practitioner opinion alone, and the rankings moved to match. Excessive Agency jumped from sixth to third. Improper Output Handling fell from fifth to tenth. This means that …

The OWASP LLM Top 10 names ten specific risks in LLM-powered apps: prompt injection, data leakage, excessive agency, and seven more, each with its own attack pattern. Testing against these risks means chaining a planted instruction through to real data exposure or confirming that rate limits cap costs, rather than just documenting that they should. …